Patch Tuesday for January 2021

There’s no stopping the juggernaut of monthly updates coming from our pals in Redmond.

This month’s load of updates, based on analysis of the new, ‘improved’ Security Update Guide, shows that we have updates for Edge, Office (2010, 2013, 2016, and 2019), Sharepoint, SQL Server, Visual Studio, Windows (7, 8.1, and 10), and Windows Server (2008, 2012, 2016, and 2019), addressing eighty-three security vulnerabilities in all.

There’s a summary of this month’s updates linked from the SUG, but as usual, it’s bafflingly incomplete.

Windows 8.1 computers can get this month’s updates via Windows Update in the Control Panel. Windows 10 computers will get the updates over the next few days, unless they’ve been configured to delay updates temporarily. Windows 7 users are still basically out of luck.

Flash is DEAD

Adobe’s kill switch for Flash went into effect as scheduled yesterday. Any Flash media you try to view from now on will show a placeholder image, which links to the End Of Life announcement for Flash.

That includes any Flash media you have lying around on your computer. For example, I found the Flash test animation on my main computer and uploaded it to my web server, where until January 12, it worked perfectly. That same Flash animation used to show on the main Flash help page, but of course that page now shows the placeholder as well.

And so ends the long, exasperating, security nightmare that was Flash. Good riddance.

Adobe Reader update, Flash ‘kill switch’

Adobe logoEarlier this week, Adobe released new versions of its Acrobat/Reader product line, to address a lone security vulnerability in earlier versions.

The new version of Acrobat Reader DC, which is the free — and widely used — version of Acrobat, is 2020.013.20074.

Recent versions of Acrobat and Reader usually manage to update themselves, but if you use either of them for viewing PDF files from untrusted sources, you should make sure you’re running the latest version. In Acrobat Reader DC, navigate its menu to Help > Check for Updates... If a newer version is available, you’ll see an option to install it.

Flash ‘Kill Switch’

We expected Adobe to show warnings in Flash after its development and support end in January 2021. Now comes news that Adobe is taking the rather drastic step of preventing Flash content from playing at all after January 12.

It’s not clear whether it will be possible to override this behaviour, so anyone who still relies on being able to play Flash content after January 12 should be looking into alternatives.

Patch Tuesday for December 2020

Microsoft recently overhauled its Security Update Guide, the web-based resource meant to be the definitive guide to Microsoft software updates. I don’t know what they had in mind, but from the standpoint of usability, there’s little improvement.

I still recommend using the SUG’s handy Download link to save the data in spreadsheet form, which you can then open in an Excel-compatible program, and use filtering and sorting functions to extract the information you need.

The official release notes for this month’s crop of updates is somewhat useful, although it contains neither a complete list of updates nor a complete list of vulnerabilities. It does at least provide a list of the software affected by the updates: Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Edge for Android, ChakraCore, Microsoft Office and Microsoft Office Services and Web Apps, Microsoft Exchange Server, Azure DevOps, Microsoft Dynamics, Visual Studio, Azure SDK, and Azure Sphere.

The Vulnerabilities tab of the SUG lists fifty-nine vulnerabilities that are addressed by the December updates. That matches the total I obtained in my analysis of the data. As for the number of actual updates, that’s increasingly difficult to determine. There are references to forty-seven help articles and twenty-one sets of release notes in the SUG data.

As usual, Windows 10 computers will get the relevant updates installed when Microsoft feels like it. Windows 8.1 computers are best updated via the Windows Update applet in the Control Panel. Users of Windows 7 and earlier versions are still pretty much out of luck, though it’s worth checking Windows Update anyway.

Adobe Reader update

Adobe logoLast week Adobe released new versions of its Acrobat and Reader products, to address fourteen security vulnerabilities in earlier versions.

In the Adobe product lineup, Acrobat is the commercial PDF builder, while Reader is the free PDF viewer. At one time you pretty much needed to have Reader installed to view PDF files, but these days PDF viewer functionality is increasingly built into operating systems and web browsers.

The new version of Reader — officially referred to as Acrobat Reader DC — is 2020.013.20064. Details are available in the related Adobe Security Bulletin.

All of Adobe’s Acrobat/Reader products update themselves by default, and there’s apparently no simple way to disable that feature. Still, if you have Reader installed, and you use it to view PDF files obtained from email or the web, it’s a good idea to make sure it’s up to date.

To check for updates, start Reader and navigate its menu to Help > Check for Updates... If there’s a newer version available, you’ll be prompted to install it.

Patch Tuesday for November 2020

This month’s pile-o-patches from Microsoft includes updates for Flash in Microsoft browsers, .NET, Exchange Server, Office (2010, 2013, 2016, and 2019), Sharepoint, Windows (7, 8.1, and 10), Windows Server (2008, 2012, 2016, and 2019), Visual Studio, Visual Studio Code, Internet Explorer 11, Edge, and Teams.

Analysis of the new (but not improved) Security Update Guide for November shows that there are at least 102 bulletins (but as many as 118, depending on what’s counted), each with an associated set of updates. As many as one hundred and eighty-five security vulnerabilities are addressed.

Dammit, Microsoft

Microsoft has once again changed the way security bulletins and updates are documented. As a result, it’s now even more difficult to find certain details about individual updates, and more difficult to ascertain just how many updates were made available for a given Patch Tuesday. It seems like Microsoft wants us to give up trying to get a handle on these things, and just install all available updates. Some people have turned to non-Microsoft resources for update information, such as the Patch Tuesday Dashboard, which is useful, but the numbers there don’t match mine, so who knows.

Getting the updates

Most Windows 10 users will get the relevant updates installed automatically over the next couple of days, although more recent versions of Windows 10 do allow updates to be delayed.

Windows 8.1 computers that have automatic updates enabled will also get those updates soon. Otherwise, you’ll need to head to the Windows Control Panel to run Windows Update.

Windows 7 users are still pretty much out of luck.

Java Version 8 Update 271

Oracle’s quarterly Critical Patch Update Advisory for October 2020, published on October 20, includes a list of eight vulnerabilities affecting Java 8u261, 7u271, and older versions.

Security risks arising from the use of older versions of Java are not as scary as they once were, since most current web browsers no longer support Java. The notable exception is Internet Explorer 11, which still supports the Java NPAPI plugin. Still, it’s best to keep Java up to date if it’s installed.

The easiest way to both check whether you have Java installed and see which version you’re running is to go to the Windows Control Panel. On Windows 7 and earlier, the Control Panel is accessible via the Start menu. On Windows 8.1 and 10, Microsoft annoyingly hid the Control Panel, but you can find it by clicking the start button and entering the text “control”. In the list of search results, you should see “Control Panel”. Click that to get to the Control Panel.

If Java is installed, you’ll see its Control Panel entry: Java (32-bit). Once you’ve clicked that, you’ll see the multi-tab Java applet. To see which version is installed, go to the Java tab and click View... The Product column shows the version. If it shows as “1.8.0_271“, that means you’re running Java 8 Update 271. Click Cancel to close that dialog.

To update Java, go to the Update tab and click the Update Now button. Follow the prompts to download and install the latest applicable version.

Alternatively, you can visit the main Java download page and install Java from there.

Flash update and upcoming retirement

Last week, on Patch Tuesday, Adobe released a new version of Flash that addresses a single critical vulnerability in previous versions.

The security bulletin for Flash 32.0.0.445 provides some additional context.

Anyone still using Flash, and in particular if Flash is enabled in Internet Explorer 11, Edge, or Google Chrome, should install the new version.

The easiest way to obtain the latest version of Flash is to go to the Get Flash page on the Adobe web site.

You’ll probably notice a warning at the top of the Get Flash page: “Important Reminder: Flash Player’s end of life is December 31st, 2020. Please see the Flash Player EOL Information page for more details.” That’s right, Flash is nearing the end of its troubled life.

Adobe plans to retire Flash at the end of 2020. After that, Adobe will no longer update or distribute Flash. They won’t fix security vulnerabilities, and you won’t be able to download it from Adobe’s web site. Adobe recommends removing Flash from all systems by the end of 2020.

Flash will live on, of course. But leaving Flash installed and enabled in browsers will become increasingly risky, as any new vulnerabilities will not be fixed by Adobe. If you must continute to use Flash for work-related activity, try to use it only as needed, and never to view content obtained from unverified Internet sources. Use a separate browser just for viewing Flash content if possible.

Patch Tuesday for October 2020

It’s time for another round of updates for your Windows computers. Earlier today Microsoft published fifty-eight bulletins, with associated updates, addressing eighty vulnerabilities in Flash, .NET, Office (2010, 2013, 2016, and 2019), SharePoint, Visual Studio, and Windows (7, 8.1, 10, and Server). Ten of the vulnerabilities are flagged as having Critical severity.

Get the full details directly from the source: Microsoft’s Security Update Guide.

Interestingly, there are no updates for any version of Internet Explorer this time around. I don’t think that’s ever happened before.

What you need to do

Windows 10

Unless you’re running one of the more recent major releases of Windows 10, and you’ve configured it to delay updates, you’re going to get the new updates within the next day or so.

If your version of Windows 10 has settings that allow you to delay updates, I strongly recommend that you use them. Given Microsoft’s recent track record with updates, which includes rushing out fixes for a sadly long series of problematic updates, it seems like the smart choice.

Windows 8.1

It’s been a while since Microsoft broke Windows 8.1 with a bad update, but if you’re at all wary about these things (as am I), you should make sure Windows Update is not configured to install updates automatically, then wait a few days before installing them manually with Windows Update.

The more adventurous among you may choose to install the new updates right away via Windows Update, or even (shudder) configure Windows Update to do it all automatically.

Windows 7

If the organization you work for has paid for extended updates, your Windows 7 computer will get any applicable updates, but your IT folks probably do that for you anyway.

The rest of the world’s Windows 7 users can only wonder how much less secure their computers are without the new updates.

Patch Tuesday for September 2020

This month’s pile from Microsoft includes fixes for vulnerabilities in Internet Explorer (9 and 11), both variants of Edge (Chromium and EdgeHTML), Office (2010, 2013, 2016, and 2019), SharePoint, Visual Studio, Windows (7, 8.1, and 10), and Windows Server (2008, 2012, 2016, 2019).

There are fifty-three security bulletins in all, and fifty-three associated updates. The updates includes fixes for one hundred and twenty vulnerabilities, twenty-one of which have been flagged as having critical severity. All of the critical vulnerabilities involve potential remote code execution.

As usual, the details are available in Microsoft’s Security Update Guide.

You can still get the Windows 7 updates legitimately, but only if you subscribe to Microsoft’s rather expensive Extended Security Updates program.

Windows 10 systems will update themselves automatically, although with newer versions, you have some control over when that happens. With Windows 10, most updates are going to get installed at some point. But delaying them can allow you to avoid updates that cause problems, since Microsoft usually issues fixes for the updates shortly after problems are discovered. But doing that potentially leaves your computer vulnerable in the interim. It’s your call. Adjust the update settings by going to Settings > Update & Security > Advanced options.

For Windows 8.1 users, it’s all about Windows Update. If you’ve configured it to install updates automatically, you’re basically in the same boat as Windows 10 users. Otherwise, locate Windows Update in the Control Panel, and click the Check for updates button.

Don’t bother trying to uninstall Microsoft Edge

If you’re old enough to remember the browser wars of the 1990s, you probably remember that Microsoft got into trouble for pushing their web browser, Internet Explorer, using tactics tied to the dominance of Windows.

Competitors were less than thrilled with Microsoft’s tactics. In 1998, an anti-trust suit was launched by the US Department of Justice against Microsoft, alleging that Microsoft was using unfair tactics, in particular by embedding Internet Explorer into Windows, making it difficult to remove.

Microsoft argued that Internet Explorer was a core part of the operating system, and could not be easily excised from Windows. This didn’t help their case much, as you can imagine.

The court agreed with the DOJ, recommending that Microsoft be broken into two organizations, one for Windows and the other for applications like Internet Explorer. After appeals, the final settlement required Microsoft to share its API (Application Programming Interface) documentation with third party companies. The idea was to remove any head start Microsoft would have in developing changes to its web browser based on technology advancements.

The DOJ did not require Microsoft to change any of its code or prevent Microsoft from tying other software with Windows in the future.

Microsoft’s tactics this time around

Fast forward to today, and Microsoft is again using questionable tactics in its fight for web browser dominance. This time around, with Internet Explorer soon to be discontinued, the browser in question is Edge (the newer, Chromium-based version).

Microsoft recently published a small support article about the new version of Edge, presumably in response to user questions. In part, it states: “The new version of Microsoft Edge is included in a Windows system update, so the option to uninstall it or use the legacy version of Microsoft Edge will no longer be available.”

So, once again, Microsoft is apparently trying to use its dominance in the desktop operating system market to push its web browser on people.

It’s hard to predict whether this tactic will actually help Edge, or whether anyone will care enough to claim antitrust activity again. I like to think people are generally somewhat better informed, and recognize that there are other, better web browsers than Edge.

UPDATE 2020Sep12: Microsoft has revised the wording of the support article about this, but the new version sounds like more of the same weak arguments they used in the 1990s:

Because Windows supports applications that rely on the web platform, our default web browser is an essential component of our operating system and can’t be uninstalled.

Windows users can download and install other browsers and change their default browser at any time.

Giant corporations trying to sound innocent when caught in their shenanigans is just embarassing.

Rants and musings on topics of interest. Sometimes about Windows, Linux, security and cool software.